CVE-2023-25012

What it actually does

Use-after-free in bigben_remove within drivers/hid/hid-bigbenff.c caused by LED controllers remaining registered after device removal, allowing memory corruption when triggered by a crafted USB device.

Why it matters to the business

May cause system instability or denial of service on affected Linux kernels when an attacker with physical access connects a malicious USB device; low likelihood given physical access requirement, stable low EPSS, and absence from known exploited lists despite exploit code being available.

How an attack unfolds

An attacker with physical access crafts a USB device that registers LED controllers through the bigben HID driver; upon device removal the dangling references trigger the use-after-free, resulting in a kernel crash or potential memory manipulation.

How to fix it

Upgrade the Linux kernel to a version containing commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel source contains commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b; confirm absence of the vulnerable bigben_remove logic via code inspection or kernel version checks against 6.1.9 and earlier.

Typical attack path

1. Physically connect a crafted USB device to a Linux system running an affected kernel
2. Trigger registration of the bigben force-feedback LED controllers
3. Disconnect or remove the USB device to invoke bigben_remove
4. Exploit the resulting use-after-free condition to crash the kernel or attempt further memory corruption

How to detect it

Inspect kernel logs and dmesg for entries referencing bigben_remove, hid-bigbenff, or USB device removal events coinciding with kernel oops or panic; correlate with physical USB insertion timestamps.

• bigben_remove
• hid-bigbenff.c
• Use-after-free in bigben

What your security team should do

• Apply the referenced kernel commit to all affected Linux distributions as soon as practical
• Restrict physical USB port access on systems where patching is delayed
• Monitor kernel logs for hid-bigbenff related oops or crashes as an interim detection measure